From 27e5155ce34ffcf2aa8d9681e1b195f4691c2e96 Mon Sep 17 00:00:00 2001
From: Ashish Sharma <ashish.sharma@espressif.com>
Date: Tue, 21 Jul 2026 16:24:06 +0800
Subject: [PATCH] fix(mbedtls): revert to non constant time rsa key gen

---
 components/mbedtls/Kconfig                           | 8 ++++----
 components/mbedtls/port/include/mbedtls/esp_config.h | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig
index bc00c91e52c..1ef606b008f 100644
--- a/components/mbedtls/Kconfig
+++ b/components/mbedtls/Kconfig
@@ -1420,7 +1420,7 @@ menu "mbedTLS"
 
             config MBEDTLS_CONSTANT_TIME_PRIME_GEN
                 bool "Constant-time prime generation"
-                default y
+                default n
                 help
                     Use mbedtls' constant-time small-factor test (a
                     constant-time GCD against the product of all odd primes up
@@ -1437,9 +1437,9 @@ menu "mbedTLS"
 
                     If disabled, the variable-time trial division that mbedtls
                     used before versions 3.6.7/4.1.1 is used instead,
-                    restoring key generation performance. Only consider
-                    disabling this if no untrusted code running on the device
-                    could observe the timing of key generation operations.
+                    restoring key generation performance.
+
+                    Please see issue: https://github.com/Mbed-TLS/mbedtls/issues/10830
 
         endmenu # Security hardening
 
diff --git a/components/mbedtls/port/include/mbedtls/esp_config.h b/components/mbedtls/port/include/mbedtls/esp_config.h
index 2cb7ee2d622..bc30d7000fa 100644
--- a/components/mbedtls/port/include/mbedtls/esp_config.h
+++ b/components/mbedtls/port/include/mbedtls/esp_config.h
@@ -260,7 +260,7 @@
 /* mbedtls 4.1.1 made the small-factor test used in prime
  * generation constant-time, which slows RSA key generation down roughly
  * tenfold and starves the idle task (the computation never yields the CPU).
- * The constant-time variant is the default; when it is explicitly disabled,
+ * The non constant-time variant is the default; when it is disabled,
  * fall back to the variable-time trial division from earlier releases. See
  * MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME in
  * tf-psa-crypto/drivers/builtin/src/bignum.c.